Configuring Cloning Groups in Gaia Portal

Step

Instructions

1

With a web browser, connect to Gaia PortalClosed Web interface for the Check Point Gaia operating system. at:

https://<IP address of Gaia Management Interface>

If you changed the default port of GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Portal from 443, then you must also enter it (https://<IP address>:<Port>).

2

Click System Management > Cloning Group.

3

Click Start Cloning Group Creation Wizard.

The Cloning Group Creation Wizard opens.

4

Select Create a new Cloning Group.

The New Gaia Cloning Group window opens.

  1. In the Cloning Group Name field, enter a name for the Cloning Group.

  2. In the IP for cloning field, select an IPv4 address (interface) for synchronizing settings between member Security Gateways.

    Select an interface on a secure internal network.

  3. In the Password field, enter a password for the administration account (cadmin).

    This password is necessary to:

    • Manage the Cloning Group

    • Add other Security Gateways to the Cloning Group

    • Create encrypted traffic between members of the Cloning Group

  4. In the Confirm Password field, enter the password again.

5

In the Shared Features screen, select features to clone to other members of the Cloning Group.

Pay attention to the features you want to clone.

For example, you might not want to clone static routes to Security Gateways that are members of a clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing..

6

Click Next for the Wizard Summary.

7

Click Finish.

The features are listed in the same order, in which they are shown in Gaia Portal.

Table: Shared Features in Gaia Portal

Shared Feature

Description

SNMP

Configure SNMP.

Banner Messages

Configure banner messages.

Job Scheduler

Schedule automated tasks that perform actions at a specific time.

DNS

Configure DNS servers.

ARP

Configure static ARP entries and proxy ARP entries, control dynamic ARP entries.

System Logging

Configure system logging settings.

Host Access Control

Configure which hosts are allowed to connect to the cluster devices.

Proxy Settings

Configure proxy settings.

Host Address Assignment

Configure known hosts.

NTP

Configure Network Time Protocol for synchronizing the system's clock over a network.

Password Policy

Configure password and account policies.

Time

Configure the time and date of the system.

Network Access

Configure network access to Gaia.

Display Format

Configure how the system displays time, date and netmask.

Mail Notification

Configure email address, to which Gaia sends mail notifications.

Inactivity timeout

Configure session parameters, such as inactivity timeout.

Users and Roles

Configure users and roles settings.

Static Routes

Configure static routes.

DHCP Relay

Configure relay of DHCP and BOOTP messages between clients and servers on different IPv4 Networks.

IPv6 DHCP Relay

Configure relay of DHCPv6 messages between clients and servers on different IPv6 Networks.

BGP

Configure dynamic routing via the Border Gateway Protocol.

IGMP

Establish multicast group memberships via the Internet Group Management Protocol.

PIM

Configure Protocol-Independent Multicast.

Static Multicast Routes

Configure static multicast routes.

RIP

Configure IPv4 dynamic routing via the Routing Information Protocol.

RIPng

Configure IPv6 dynamic routing via the Routing Information Protocol.

OSPF

Configure IPv4 dynamic routing via the Open Shortest-Path First v2 protocol.

IPv6 OSPF

Configure IPv6 dynamic routing via the Open Shortest-Path First v3 protocol.

Route Aggregation

Create a supernet network from the combination of networks with a common routing prefix.

Inbound Route Filters

Configure Inbound Route Filters for RIP, OSPFv2, BGP, and OSPFv3 (supports IPv4 and IPv6).

IP Reachability Detection

Configure reachability detection of IP Addresses.

Route Redistribution

Configure advertisement of routing information from one protocol to another (supports IPv4 and IPv6).

Route Map

Configure dynamic routing route maps.

Prefix Lists and Trees

Configure dynamic routing prefix lists and trees.

Routing Options

Configure protocol ranks and trace (debug) options.

Policy Based Routing

Configure policy based routing (PBR) priority rules and action tables.

Scheduled Backups

Configure Gaia scheduled backups.

Step

Instructions

1

Sign out of the Gaia Portal.

2

Sign in to the same Gaia Portal using the cadmin account and password.

(Alternatively, log in to the Gaia Portal on the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. using the cadmin credentials.)

Important - No unique URL or IP address is needed to access the Cloning Group Portal or Clish command line. Use the URL or IP address of the member Security Gateway.

3

In System Management > Cloning Group, select features from the Shared Features.

4

Click Set Shared Features.

The shared features are propagated to all members of the group.

If, for example, you then configure a primary DNS server on one member of the Cloning Group, and DNS is one of the Shared Features, then the DNS settings are propagated to all members of the group. The DNS settings in the Portal of each member are grayed out.

Note - A user that gets cloning group administration privileges (the RBA role CloningGroupManagement), can manage specific Cloning Groups features granted by the administrator and grant Cloning Group capabilities to other users, including remote users. When these privileges are assigned, the Group Mode button shows in Gaia Portal.

Step

Instructions

1

Connect to the Gaia Portal on a Cloning Group member Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

2

At the top, click Group Mode.

The Security Gateway switches to Cloning Group management mode.

Step

Instructions

1

Connect to the Gaia Portal on a Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

2

In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

The Cloning Group Wizard opens.

3

Select Join an existing Cloning Group.

4

The Join Existing Cloning Group window opens.

  • In the Remote Member Address field, enter the IPv4 address of a remote member of the Cloning Group.

  • In the IP for cloning field, select an IP address (interface) for synchronizing the settings between Security Gateways.

    Select an interface on a secure internal network. Make sure there is a physical connectivity to the Gaia computer that runs the Cloning Group, to which you wish to join.

  • In the Password field, enter a password for the Cloning Group administration account (cadmin).

    (The same password you entered when you created the Cloning Group, to which you wish to join.)

    The cadmin password:

    • Lets you log in to the cadmin account

    • Is used to create authentication credentials for members during synchronization

5

Click Finish.

Select this option, if the Security Gateway is a member of a ClusterXL.

Important - In a Cluster, you must configure all the Cluster Members in the same way.

Step

Instructions

1

Connect to the Gaia Portal on a Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

2

In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

The Cloning Group Creation Wizard opens.

3

Select Cloning group follows ClusterXL.

  • Enter the Cloning Group name.

  • Enter a password for the Cloning Group administration account (cadmin).

4

Click Next for the Wizard Summary.

5

Click Finish.

6

Repeat Steps 1-5 for all members of the cluster.

Note - For troubleshooting steps, refer to sk119496.